Privacy notice

Who we are

Susan Mechan, trading as NeuroAchieve UK, is the data controller for the personal information described here. Contact us at hello@neuroachieveuk.co.uk or 07718 992418.

What we collect

• Contact details: names, addresses, phone numbers and email addresses.
• Health and development information you share with us, such as diagnosis, mobility, medication that affects sessions, and goals.
• Session notes, goals, progress records and reports.
• Photos or videos, but only with separate written consent.
• Payment and invoicing records.

Why we use it, and our lawful basis

• To reply to your enquiry: our legitimate interest in responding to people who contact us (UK GDPR Article 6(1)(f)). If your message includes health information, we rely on your explicit consent — the tick box on the form — to read and reply to it (Article 9(2)(a)). You can withdraw that at any time and we will delete the enquiry. When someone writes on another person’s behalf, we ask them to confirm that person has agreed, and we check with the person at our first contact.
• To provide sessions and keep records: to perform our agreement with you (Article 6(1)(b)). Health information is handled under Article 9(2)(h), the provision of health and social care, and everyone who sees it owes you a duty of confidentiality.
• To meet legal obligations: for example tax records, insurance and safeguarding.
• Photos and videos: only with your explicit consent, given separately for each place they might appear (website, Facebook, Instagram, YouTube). You can withdraw consent at any time.

Who we share it with

We only share your information with people involved in your care or funding (such as your NHS team, GP, school, case manager or care home) when you have agreed to it, or where the law requires it, for example to protect someone from harm. We never sell your information, and we never use it for advertising.

We also use a small number of suppliers who handle information on our behalf, under contract and only on our instructions:

• Cloudflare hosts this website, passes enquiry-form submissions to us, and provides Cloudflare Web Analytics, which counts page visits without cookies. Cloudflare is a US company; transfers are covered by the UK extension to the EU–US Data Privacy Framework and standard contractual clauses.
• Resend sends the enquiry email from the website to our inbox. Resend is a US company, covered by the same safeguards. Your message is not stored on this website.
• Our email and accounting providers, for replying to you and for invoicing.

If you email us instead of using the form, your message travels through your own email provider and ours, and we have no control over your provider.

Referrals from professionals

Case managers, schools, NHS teams and care homes sometimes contact us about someone else. When we receive information about you from someone else, we will tell you within a month of receiving it, or at our first contact with you, whichever is sooner — unless you already know. We expect the referrer to have your permission before they write to us.

Children and young people

For a child under 13 we take instructions from someone with parental responsibility. From 13 upwards we ask the young person themselves wherever they are able to decide, and we explain things in a way that suits them. A young person can ask to see their own records, and a parent can ask on their behalf where that is appropriate. Our easy read page explains what we do in short sentences.

Visiting this website

This website sets no cookies and has no advertising trackers. Our host, Cloudflare, keeps short-lived technical logs including your IP address to deliver pages and block attacks. We use Cloudflare Web Analytics to count visits to each page; it doesn’t use cookies, doesn’t build a profile of you and doesn’t follow you to other websites. The fonts are served from this website itself, so no other company receives your IP address when a page loads.

How long we keep it

Records for adults are kept for eight years after our last contact. Records for children are kept until their 25th birthday (or 26th if they were 17 when our work ended). Enquiries that don’t lead to sessions are deleted after 12 months.

How we keep it safe

Records are kept in password-protected accounts, on devices protected by a passcode. Paper notes are kept to a minimum and stored securely. Enquiries sent through this website are not stored on the website itself — they are emailed to us and then handled like any other record.

Your rights

You can ask us to:

• show you the information we hold about you, and give you a copy;
• correct anything that is wrong, or complete anything that is missing;
• delete it, where we do not need to keep it for a legal or safeguarding reason;
• limit how we use it while a question about it is sorted out;
• send a copy to you or another provider in a portable format, where we hold it by consent or under our agreement with you;
• object to us using it where we rely on legitimate interests — including replying to an enquiry.

Where we rely on your consent you can withdraw it at any time, and that does not affect anything we did before you withdrew it. Ask by email or phone. We will respond within one month, and we will tell you if we need longer because a request is complex. There is no charge.

Complaints

If you’re unhappy with how we’ve handled your information, please tell us first at hello@neuroachieveuk.co.uk. We’ll acknowledge your complaint within 30 days and tell you what we’re doing about it. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Last updated: September 2026